ports

type AuthProvider interface {
	// GetCredentials returns username and password for a registry.
	GetCredentials(ctx context.Context, registry string) (username, password string, err error)
}

type CapabilityAnalyzer interface {
	ExtractCapabilities(profile entities.ProfileReader) map[string][]capabilities.Capability
}

type CapabilityCollector interface {
	CollectRequiredCapabilities(ctx context.Context, profile entities.ProfileReader, runtime PluginRuntime, pluginDir string) (map[string][]capabilities.Capability, error)
}

type CapabilityGatekeeperPort interface {
	GrantCapabilities(
		required capabilities.Grant,
		capabilityInfo map[string]CapabilityInfo,
		trustAll bool,
	) (capabilities.Grant, error)
}

type CapabilityGranter interface {
	GrantCapabilities(ctx context.Context, required map[string][]capabilities.Capability, trustAll bool) (map[string][]capabilities.Capability, error)
}

type CapabilityInfo struct {
	ProfileSpecific *capabilities.Capability
	Capability      capabilities.Capability
	PluginName      string
	IsProfileBased  bool
	IsBroad         bool
}

type Closer interface {
	io.Closer
}

type DataRedactor interface {
	Redact(input string) string
}

type EmbeddedPluginSource interface {
	// Get returns the file path to an embedded plugin.
	// Returns empty string if not found.
	Get(name string) string

	// List returns names of all embedded plugins.
	List() []string
}

type EngineFactory interface {
	CreateEngine(ctx context.Context, profile entities.ProfileReader, grantedCaps map[string][]capabilities.Capability, pluginDir string, filters dto.FilterOptions, execution dto.ExecutionOptions, skipSchemaValidation bool) (ExecutionEngine, error)
}

type ExecutionEngine interface {
	Execute(ctx context.Context, profile entities.ProfileReader) (*execution.ExecutionResult, error)
	Close(ctx context.Context) error
}

type IntegrityVerifier interface {
	// VerifySignature checks the signature of a plugin in the registry.
	VerifySignature(ctx context.Context, ref values.PluginReference) (*SignatureResult, error)

	// Sign signs a plugin artifact (for publishing).
	Sign(ctx context.Context, ref values.PluginReference) error
}

type LockfileRepository interface {
	// Load reads a lockfile from the given path.
	// Returns nil, nil if lockfile doesn't exist.
	Load(ctx context.Context, path string) (*entities.Lockfile, error)

	// Save writes a lockfile to the given path.
	Save(ctx context.Context, lockfile *entities.Lockfile, path string) error

	// Exists checks if a lockfile exists at the given path.
	Exists(ctx context.Context, path string) (bool, error)
}

type OutputFormatter interface {
	Format(result *execution.ExecutionResult) error
}

type OutputFormatterFactory interface {
	// Create returns a formatter for the given format name.
	// options is implementation-specific (typically output.FactoryOptions).
	// Returns error if format is unknown.
	Create(format string, writer io.Writer, options interface{}) (OutputFormatter, error)

	// SupportedFormats returns list of available format names.
	SupportedFormats() []string
}

type OutputWriter interface {
	Write(ctx context.Context, data []byte, dest string) error
}

type Plugin interface {
	// Describe returns plugin metadata including declared capabilities.
	Describe(ctx context.Context) (*PluginInfo, error)
}

type PluginDigester interface {
	// DigestBytes computes SHA-256 of raw bytes.
	DigestBytes(data []byte) string

	// DigestFile computes SHA-256 of a file.
	DigestFile(ctx context.Context, path string) (string, error)
}

type PluginDirectoryResolver interface {
	ResolvePluginDir(ctx context.Context) (string, error)
}

type PluginInfo struct {
	Name         string
	Version      string
	Description  string
	Capabilities []capabilities.Capability
}

type PluginRegistry interface {
	// Pull downloads a plugin artifact from the registry.
	Pull(ctx context.Context, ref values.PluginReference) (*dto.PluginArtifactDTO, error)

	// Push uploads a plugin artifact to the registry.
	Push(ctx context.Context, artifact *dto.PluginArtifactDTO) error

	// Resolve resolves a reference to its content digest.
	Resolve(ctx context.Context, ref values.PluginReference) (values.Digest, error)
}

type PluginRepository interface {
	// Find retrieves a cached plugin by reference.
	Find(ctx context.Context, ref values.PluginReference) (*entities.Plugin, string, error)

	// Store persists a plugin with its WASM binary.
	// Returns the path to the stored WASM file.
	Store(ctx context.Context, plugin *entities.Plugin, wasm io.Reader) (string, error)

	// List returns all cached plugins.
	List(ctx context.Context) ([]*entities.Plugin, error)

	// Prune removes old versions, keeping only the specified number.
	Prune(ctx context.Context, keepVersions int) error

	// Delete removes a specific plugin from cache.
	Delete(ctx context.Context, ref values.PluginReference) error
}

type PluginRuntime interface {
	// LoadPlugin compiles and caches a plugin from WASM bytes.
	LoadPlugin(ctx context.Context, name string, wasmBytes []byte) (Plugin, error)

	// Close releases runtime resources.
	Close(ctx context.Context) error
}

type PluginRuntimeFactory interface {
	// NewRuntime creates a new plugin runtime with optional configuration.
	// Accepts functional options for capabilities, redaction, memory limits, and caching.
	NewRuntime(ctx context.Context, opts ...RuntimeOption) (PluginRuntime, error)
}

type ProfileLoader interface {
	LoadProfile(path string) (*entities.Profile, error)
}

type ProfileValidator interface {
	Validate(profile *entities.Profile) error
	ValidateWithSchemas(ctx context.Context, profile *entities.Profile, runtime PluginRuntime) error
}

type RuntimeOption any

type SecretResolver interface {
	// Resolve returns the secret value by name.
	// The resolved value is automatically tracked for redaction.
	Resolve(name string) (string, error)
}

type SensitiveValueProvider interface {
	// Track registers a sensitive value to be protected (redacted).
	Track(value string)

	// AllValues returns all tracked sensitive values.
	AllValues() []string
}

type SignatureResult struct {
	SignedAt        time.Time
	Signer          string
	TransparencyLog string
	Certificate     []byte
	Verified        bool
}

type SystemConfigProvider interface {
	LoadConfig(ctx context.Context, path string) (*system.Config, error)
}

type VersionResolver interface {
	// Resolve converts a version constraint to an exact version.
	// Examples:
	//   "@1.0"   -> "1.0.x" (latest 1.0.x)
	//   "^1.2.0" -> "1.x.x >= 1.2.0"
	//   "~1.2.3" -> "1.2.x >= 1.2.3"
	Resolve(constraint string, available []string) (string, error)
}